SCAMMERS TRY TO TRICK LASTPASS USERS INTO GIVING UP CREDENTIALS BY TELLING THEM THEY'RE DEAD

Summary from the TLDR InfoSec newsletter

CryptoChameleon cybercriminal group targets LastPass users with phishing emails claiming "Legacy Request Opened (URGENT IF YOU ARE NOT DECEASED)" that trick victims into entering master passwords on fake sites by exploiting legacy access scenarios when family members request deceased users' accounts. The campaign uses domain spoofing, fabricated support case details, and phone calls to direct victims to attacker-controlled URLs designed to harvest credentials for cryptocurrency theft. Organizations should implement phishing-resistant MFA for password managers, educate employees about this specific "Legacy Request" subject line, and establish policies requiring additional authentication factors beyond master passwords for account access.